Key points. A valid ground under article 28-8(1) of Korea's Personal Information Protection Act ("PIPA") and a signed group DPA answer different questions. Article 28-8(4) applies whichever ground is used, and article 29-10 of the Enforcement Decree lists the protective measures that must be agreed with the recipient in advance and reflected in the contract: security safeguards under Decree article 30(1), grievance handling and dispute resolution, and other measures needed to protect data subjects. There is no prescribed form; PIPC Notice No. 2023-11 has none, and it was unamended on 14 September 2026. Article 28-11 carries the same framework to the onward leg from headquarters to a third country. Missing terms are a ground for a transfer suspension order under article 28-9(1)(i), and failure to obey that order leads to a penalty surcharge under article 64-2(1)(viii).
Headquarters legal sends the group DPA and its standard contractual clause annexes to Korea. The Korean entity signs and returns them. It has also put a transfer ground in place, such as separate consent or disclosure in the privacy policy, so the Korean side of the work looks complete.
Korean law separates two questions here. The first is the ground for the transfer. The second is what the contract governing that transfer has to contain. This note deals with the second question, which is the one most often left unchecked in practice.
Two related questions are covered elsewhere on this site and are not repeated here. How the five grounds work, and where certification fits among them, is in Our headquarters is certified. Is that a transfer ground under Korean law?. Why the word "processor" in the group DPA does not fix the Korean entity's position or narrow its duties is in Your group DPA calls us a processor. Korean law has no such slot. That second page should be read first, because the contract terms discussed below can only be checked once the parties' positions have been worked out under Korean law.
What does article 28-8(4) ask for beyond the ground?
Article 28-8(4) covers every transfer made under the proviso to article 28-8(1). The obligations below therefore attach whichever of the five grounds the company has chosen.
The paragraph has three strands. The company must comply with the other PIPA provisions on cross-border transfers, with articles 17 to 19, and with Chapter 5 of the Act on the protection of data subjects' rights. On top of those, it must take the protective measures that the Presidential Decree prescribes.
Chapter 5 mostly shows itself in how individual requests are handled rather than in the wording of the contract. The deadline for responding to a request and the party that owes the response are set out article by article in Erasure requests do not follow the data abroad (an English summary within a Korean article).
What must the contract actually contain?
Article 29-10(1) of the Enforcement Decree names three protective measures:
- the security safeguards under article 30(1) of the Decree;
- measures for handling grievances and resolving disputes concerning infringement of personal information; and
- other measures necessary to protect data subjects.
Article 30(1) of the Decree is itself a list. It includes an internal management plan, restriction of access rights and authentication means, encryption, retention of access logs, and physical measures.
The operative provision is article 29-10(2). It requires the company to agree these matters with the recipient in advance and to reflect them in the contract or similar documents. Two things have to be checked together: that the consultation took place, and that its result was written into the contract.
The fact that headquarters signed first does not settle whether there was prior consultation. The company should check whether the measures were actually discussed before the transfer and whether what was agreed appears in the contract or one of its annexes. Where a measure is missing, it should be agreed and added before the transfer. The Korean text of article 29-10 of the Enforcement Decree is the reference point for that comparison.
Is there a prescribed form to wait for?
No form existed on the date checked. PIPC Notice No. 2023-11, the notice on the operation of cross-border transfers, sets out the procedures for the expert committee on cross-border transfers, certification, recognition of destination countries and suspension orders. It contains no provision on the form or level at which the article 28-8(4) protective measures are to be written into a contract. The Decree decides what has to be agreed and reflected, and the company has to draft the wording itself.
The Notice carries a review deadline. Its article 28 requires the PIPC to review the Notice every three years counted from 15 September 2023, by 14 September of each third year, and the first such point was 14 September 2026. Checked against that date, the Notice was still the 2023 text without amendment. Six PIPC notices were published in the official gazette between 1 and 14 September 2026, Nos. 2026-11 to 2026-16, and none of them concerned cross-border transfers. The structure of the Notice was also unchanged: certification in articles 11 to 17, recognition of destination countries in articles 18 to 22, and suspension orders in articles 23 to 27. A review deadline does not guarantee that a form will be made, or when.
Three points to check in your own contract
Whether a particular group DPA lacks something cannot be known without reading it. What can be stated is the list of items the Korean provisions require, and the sensible order is to compare one's own contract against that list.
- Grievance handling and dispute resolution. Find where the contract deals with the measure in article 29-10(1)(ii) of the Decree.
- Proof that it happened before the transfer. Decide what the company would produce to show that the consultation and its reflection in the contract were completed before the data moved.
- The contract as a regulated act. Article 28-8(5) prohibits entering into a cross-border transfer contract whose terms violate PIPA. Signing is itself the act the provision addresses. Reading the contract together with the Korean-law positions of the parties, as described in the processor note, makes this check quicker.
Headquarters passes the data on. Does Korean law follow it?
Article 28-11 of the Act applies articles 28-8 and 28-9 mutatis mutandis where the person who received the personal data transfers it on to a third country. In doing so it reads "personal information controller" as "the person who received the personal information".
The same framework therefore reaches the leg from headquarters to a cloud provider or vendor in a third country. The sub-processor clause of the group DPA, and the list of sub-processors behind it, should be reviewed against the Korean provisions and not only against the law of the headquarters jurisdiction.
What follows if the terms are missing?
The enforcement route is unusual. Article 64-2(1)(vii) makes a breach of article 28-8(1) a ground for a penalty surcharge, but breaches of article 28-8(4) and (5) are not among the listed items. Administrative fines differ by paragraph. Failure to take the article 28-8(4) protective measures carries an administrative fine of up to KRW 30 million under article 75(2)(14), while a breach of article 28-8(5) is not among the administrative fine items.
A heavier route runs alongside. Article 28-9(1)(i) lists breaches of article 28-8(1), (4) and (5) together as grounds for a transfer suspension order. If the company does not comply with the order, it then becomes subject to a penalty surcharge under article 64-2(1)(viii), with a general ceiling of 3% of total revenue. Whether the separate aggravated conditions in article 64-2(2) apply has to be checked as well; they are described in the section on the amendment below.
The weight of a suspension order lies less in money than in the fact that the data flow stops. The time to contest it is also short. An objection must be made within 7 days of receiving the order, and the PIPC notifies the result in writing within 30 days of receiving the objection (article 28-9(2) of the Act and article 29-12 of the Decree).
When the documents and the actual flow diverge
On 24 June 2026, at its 12th plenary meeting, the PIPC imposed a penalty surcharge of KRW 210 million and a corrective order on Bithumb, a Korean virtual asset exchange (press release dated 25 June 2026). The period in question ran from September to November 2025, during which Bithumb shared its order book with an overseas exchange in its Tether (USDT) market.
Bithumb had obtained separate consent from data subjects for a transfer to the Stellar exchange. The PIPC found that member numbers and order information had in fact been transferred to a system operated by a different exchange (bingx.com). Where the documents do not follow the actual data flow, the ground the company put in place does not cover the transfer that happened.
A second set of transfers was also in issue: when moving users' virtual assets to 13 overseas exchanges, Bithumb provided the sender's and recipient's personal data for anti-money-laundering purposes without, among other things, separate consent. The PIPC accepted that this provision was itself necessary. It nonetheless held that cross-border transfers are closely tied to the data subject's right of self-determination, so the requirements and procedures have to be observed carefully. A legitimate purpose did not relieve the company of the procedure. The corrective order required Bithumb to meet the lawful requirements and to inform data subjects clearly of that through its privacy policy.
Did the September 2026 amendment change any of this?
The amended Act in force since 11 September 2026 (Act No. 21445) did not change the wording of articles 28-8, 28-9 or 28-11. What changed was article 64-2.
A new paragraph (2) creates a penalty surcharge band with a ceiling of 10% of total revenue for three cases: a repeated breach of the same item within three years of a surcharge decision, limited to intentional or grossly negligent conduct; an intentional or grossly negligent breach affecting 10 million or more data subjects; and a case where failure to comply with a corrective order under article 64(1) leads to a breach involving a leak or similar event under article 64-2(1)(ix). The former paragraph (2) has become paragraph (3). The last of these cases should not be read as covering non-compliance with a transfer suspension order in general. The conditions can be read in the Korean text of article 64-2.
Checklist: contract terms against operating evidence
A list of ticked boxes is less useful than a table that puts the contract wording and the operating evidence on the same row. If the last two columns are empty, the review is not finished, even with a signed DPA on file.
| Item | Clause to find in the DPA or annexes | Operating evidence | Mismatch or unconfirmed | Owner at headquarters |
|---|---|---|---|---|
| Transfer ground and notice | Purpose, country, recipient and retention period of the transfer; notice of changes | Consent screen and privacy-policy versions; dispatch records | Whether the actual region and recipient match the documents | Privacy / Product |
| Security safeguards | Access rights, encryption, access logs, incident notice | Access lists, configuration values, log retention policy, inspection results | Whether the contractual commitments are applied in the live environment | Security / IT |
| Grievance handling and dispute resolution | Forwarding of data subject requests, response deadline, allocation of responsibility | Request tickets, forwarding route, contact persons and escalation records | Whether headquarters' process can meet the Korean deadlines | Privacy / Customer Support |
| Prior consultation and reflection in the contract | Procedure for agreeing and changing protective measures | Consultation emails, meeting notes, annex execution date | Whether consultation and reflection were completed before the transfer | Legal / Privacy |
| Onward transfer | Sub-processor approval and notice; flow-down of the same obligations | Current recipient list, vendor contracts, data flow diagram | Whether the third-country leg after headquarters is missing | Procurement / Privacy |
| Actual data flow | Processing location and role by service and system | Cloud regions, overseas access rights, API flows | Whether the controller and processor labels match the actual roles | IT / Legal |
The ground under article 28-8(1) and the contract terms under article 28-8(4) should be assessed as separate items. Because the prior consultation under Decree article 29-10(2) is not proved by the signature date alone, the consultation record and the annex execution date should be checked together.
The same contract appears on document request lists in investment and M&A due diligence. If a breach occurs, it will be looked at again during the investigation, so it is worth keeping it in order alongside the breach response file described in Breach notification.
Related
- Our headquarters is certified. Is that a transfer ground under Korean law?: the five grounds, the certification list, and the basic contract layer
- Your group DPA calls us a processor. Korean law has no such slot: why the DPA label does not decide the Korean entity's position
- Erasure requests do not follow the data abroad: who answers data subject requests after transfer
- 본사가 보내온 글로벌 DPA에 서명했습니다 (Korean): the full version of this note
- English summaries: the index of English pages on this site
Frequently asked questions
Q. We have a valid transfer ground and a signed group DPA. Is the contract side finished?
Q. Has the PIPC published a model clause or form for these protective measures?
Q. Headquarters passes the data on to a cloud provider or vendor in a third country. Does Korean law reach that leg?
Q. What happens if the protective measures are not in the contract?
Sources
- Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 28-8, 28-9, 28-11, 64-2 and 75: Korean text
- Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671, in force 11 September 2026), articles 29-10, 29-12 and 30(1): Korean text
- PIPC Notice No. 2023-11 on the operation of cross-border transfers (made and in force 16 October 2023), articles 11 to 28; checked as the unamended original text as of 14 September 2026 against the National Law Information Center database of administrative rules and the official gazette
- PIPC press release on the Bithumb cross-border transfer decision (25 June 2026; decided at the 12th plenary meeting on 24 June 2026; penalty surcharge of KRW 210 million and corrective order): Korean text
This note is a general summary of Korean law for readers outside Korea and is not legal advice; what a particular transfer contract needs turns on the data flow and the parties' positions, and requires individual review. The position on PIPC Notice No. 2023-11 is stated as checked against 14 September 2026 and may change after that date. All English renderings of Korean statutes and notices on this page are unofficial and carry no legal effect; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Questions about this page can be sent through the contact page.